Medium severity5.3NVD Advisory· Published May 12, 2021· Updated Jun 17, 2026

CVE-2020-36289

Description

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Atlassian/Crowd Data Center and Serverllm-fuzzy
Range: <8.5.13, 8.6.0-<8.13.5, 8.14.0-<8.15.1
Atlassian/Jira Servercpe-rescue2 versions
unspecified+ 1 more
- (no CPE)range: unspecified
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*range: >=8.6.0,<8.13.5
Atlassian/Jira Core Data Centercpe-rescue
Range: unspecified
Atlassian/Data Center
cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
Range: <8.5.13
Atlassian/Jira
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Range: <8.5.13
Atlassian/Jira Data Center
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
Range: >=8.6.0,<8.13.5

Patches

Vulnerability mechanics

References

jira.atlassian.com/browse/JRASERVER-71559nvdIssue TrackingPermissions RequiredVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.079
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000